663488620f93fb0b66ee0528bf16e0b9b74bcc3ce1e3ed7a11330ba5c491bb42

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 22:27

Target

663488620f93fb0b66ee0528bf16e0b9b74bcc3ce1e3ed7a11330ba5c491bb42.dll
Size

6KB
MD5

fcc887120164b2deff22c49d3d428a5e
SHA1

56e3056c7eb30fc527672fcec45cfd7a38e38dbe
SHA256

663488620f93fb0b66ee0528bf16e0b9b74bcc3ce1e3ed7a11330ba5c491bb42
SHA512

3e599968a03946ee5f68adc0f4cc0e04fffc26282c4cc1b7e1b2dd0f09f4a042684bc94bdab07e6db7689c8719d4678d231204aa075a1cf41692c2d8ca34c0b2
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI2330mC1sthE/MNwX3xCt5:unSR6bgY53ElaTbIY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28
PID 2180 wrote to memory of 2888	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\663488620f93fb0b66ee0528bf16e0b9b74bcc3ce1e3ed7a11330ba5c491bb42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\663488620f93fb0b66ee0528bf16e0b9b74bcc3ce1e3ed7a11330ba5c491bb42.dll,#1
  2⤵
  PID:2888